Flash Trade's Solana perpetuals exchange suffered a $98K unauthorized withdrawal when an attacker exploited an incomplete validation path in MagicBlock's SDK. The ephemeral macro's undelegation callback failed to validate a fake account, allowing the attacker to trigger a fake withdrawal.

FlashTrade (a Solana perps protocol) detected an unauthorized $98,000 withdrawal from its ephemeral instance. As a precaution, trading, deposits, and withdrawals were paused. Thanks to the newly rolled-out withdrawal batching and monitoring system, the incident was detected quickly and contained. The team will fully cover the amount, with all user funds safe.